Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat(auth): gate jackett/qbittorrent/radarr/sonarr UIs with oauth2-proxy sidecar (rollout)

Browse Source 
Roll the verified Option-B per-app oauth2-proxy sidecar out to the remaining
four forward-auth apps after the pihole canary was confirmed fail-closed
(unauthenticated -> 302 to Keycloak, pod 2/2, clean sidecar OIDC discovery).

Each app's Gateway route now terminates at its oauth2-proxy sidecar (:4180,
--allowed-group=media-users, --upstream=http://127.0.0.1:<uiport>); the
gateway-ingress CiliumNetworkPolicy allows the Gateway to reach ONLY :4180, so
the bare UI is never served un-authenticated (fail-closed; R-IDP-02/06). The
apps' own app/API ports stay in-Service for EAST-WEST callers (arr ->
qbittorrent:8080 / jackett:9117) via the existing reciprocal-ingress allows.

- keycloak: confidential jackett/qbittorrent/radarr/sonarr clients (realm-import
  + realm-clients mirror), provisioned live via kcadm (groups membership mapper).
- secrets: four SOPS/age <app>-oauth2-proxy-credentials, wired into apps/wave-0
  and apps/wave-1 by the renderer's sidecar-creds wave rule.
- ci: remove the temporary canary deferral (all five goldens now reproduce).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-31 08:45:46 -05:00
1 parent 72d4720d58
commit b2752aec48
13 files changed
+536 -18
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ci/render-golden.sh
+1 -8
View File
@@ -40,14 +40,7 @@ PYTHON="${PYTHON:-python3}"
# by-product of `--all catalog` but must NOT have a golden; the gate ignores
# their rendered output. Onboarding one = add its golden and drop it here.
#
# CANARY DEFERRAL (forward-auth oauth2-proxy sidecar rollout, 2026-08-31): the renderer now
# emits a per-app oauth2-proxy sidecar for every forward-auth app (pihole/jackett/qbittorrent/
# radarr/sonarr). pihole is the CANARY — its golden carries the sidecar and is verified fail-closed
# in-cluster FIRST. The other four are deferred to the ROLLOUT commit so partial progress is safe
# (their committed goldens stay sidecar-less and keep serving exactly as today). They are listed
# here TEMPORARILY so the canonical render's fresh (sidecar) output does not flag drift against the
# deferred sidecar-less goldens. The ROLLOUT commit re-renders their goldens and REMOVES them here.
: "${RENDER_GOLDEN_NOT_ONBOARDED:=keycloak vm-demo jackett qbittorrent radarr sonarr}"
: "${RENDER_GOLDEN_NOT_ONBOARDED:=keycloak vm-demo}"
log "Stage: render==golden reproducibility (canonical render vs committed apps/)"